CVE-2024-13867: Listivo WordPress Theme XSS Vulnerability

CVE-2024-13867 Overview

CVE-2024-13867 is a reflected cross-site scripting (XSS) vulnerability in the Listivo Classified Ads WordPress theme developed by Tangiblewp. The flaw affects all versions up to and including 2.3.67 and stems from insufficient input sanitization and output escaping on the s search parameter. Unauthenticated attackers can craft a malicious URL that injects arbitrary JavaScript into the rendered page. Execution occurs when a victim clicks the crafted link, allowing script actions in the context of the victim's browser session.

Critical Impact
Successful exploitation enables session hijacking, credential theft, redirection to attacker-controlled sites, and administrative account compromise when a logged-in administrator is targeted.

Affected Products

Tangiblewp Listivo Classified Ads WordPress Theme versions <= 2.3.67
WordPress installations using the Listivo theme with default search functionality
Any site exposing the vulnerable s query parameter to unauthenticated visitors

Discovery Timeline

2025-02-13 - CVE-2024-13867 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13867

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The Listivo theme accepts the s search parameter and reflects its value into the rendered HTML response without adequate sanitization or context-aware output escaping. An attacker supplies JavaScript payloads through the URL that the theme echoes into the page markup. The browser then parses the injected content as executable script rather than inert text.

Exploitation requires user interaction, typically achieved through phishing links or attacker-controlled pages that redirect victims to the crafted URL. Because the attack occurs in the victim's authenticated session context, injected code can read the DOM, exfiltrate cookies not marked HttpOnly, submit forms on behalf of the user, or trigger administrative actions.

Root Cause

The root cause is missing input sanitization on the s GET parameter combined with absent output escaping when the value is rendered into HTML. The theme trusts user-supplied search input and inserts it directly into the response body. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses() that were not applied to this reflection path.

Attack Vector

The attack is network-based and requires no privileges. The attacker delivers a URL such as https://victim-site.tld/?s=<payload> where <payload> contains an XSS vector targeting the reflection sink. When a victim visits the link, the theme returns HTML containing the payload, which the browser executes. Refer to the Wordfence Vulnerability Report for additional technical details.

No verified public proof-of-concept code is available for this vulnerability. The exploitation pattern follows standard reflected XSS techniques against the s parameter.

Detection Methods for CVE-2024-13867

Indicators of Compromise

Web server access logs containing s= parameter values with HTML tags, script, onerror, onload, or URL-encoded equivalents such as %3Cscript%3E
Referrer headers pointing to unfamiliar external domains preceding suspicious search queries
Outbound requests from user browsers to attacker-controlled domains shortly after visiting a Listivo-powered site
WordPress administrator sessions originating from unexpected geographic locations following link clicks

Detection Strategies

Deploy web application firewall rules that flag XSS payload patterns in the s query parameter
Monitor HTTP request logs for encoded and unencoded script tags, event handlers, and javascript: URIs
Correlate access log anomalies with authentication events to identify successful session compromise
Perform periodic content security policy (CSP) violation report review to detect inline script execution attempts

Monitoring Recommendations

Enable verbose logging on WordPress installations running the Listivo theme and forward logs to a centralized analytics platform
Alert on repeated requests to the same URL pattern from single source IPs testing payload variants
Track administrator account activity for unauthorized plugin installations, user creation, or theme modifications

How to Mitigate CVE-2024-13867

Immediate Actions Required

Update the Listivo Classified Ads WordPress Theme to a version later than 2.3.67 as soon as the vendor publishes a patched release
Audit WordPress administrator accounts and force password resets if suspicious link activity is observed
Enable a web application firewall with reflected XSS signatures in blocking mode
Review recent site activity for unauthorized changes to posts, plugins, or user roles

Patch Information

Monitor the ThemeForest Item Listing and the Wordfence Vulnerability Report for vendor patch availability. Apply the fixed version through the WordPress theme update mechanism once released.

Workarounds

Deploy a Content Security Policy header that restricts inline script execution and limits allowed script sources
Configure WordPress cookies with HttpOnly and Secure flags to reduce cookie theft impact
Restrict administrative access to trusted IP addresses through server-level rules until the patch is applied
Use a reverse proxy or WAF rule to strip or reject requests where the s parameter contains HTML metacharacters

bash

# Example nginx rule to block suspicious 's' parameter values
if ($arg_s ~* "(<|>|script|onerror|onload|javascript:)") {
    return 403;
}